Privacy Policy Review Team Process 


Recognizing the March 2011 deadline for completion of fusion center privacy policies 
that are “at least as comprehensive” as the ISE Privacy Guidelines, we have been 
working closely with our mission and business partners to improve and streamline the 
technical assistance review process currently provided under the joint U.S. Department of 
Homeland Security (DHS)/U.S. Department of Justice Fusion Process Technical 
Assistance Program. 


The current approach is that fusion centers submit versions of their comprehensive 
privacy policies to be reviewed by the Privacy Policy Review Team (PPRT), which 
results in a checklist of key policy issues being returned to the center. This process can 
repeat itself multiple times. In April 2010, in cooperation with the Global Advisory 
Committee’s (GAC) Global Privacy and Information Quality Working Group, a revised 
version of the Fusion Center Privacy Policy Development: Privacy, Civil Rights, and 
Civil Liberties Policy Template (Template) was released to the fusion centers. This 
revised version reflects numerous updates and enhancements based on lessons learned 
from the review process and discussions with the DHS Chief Privacy Officer regarding 
the standards that need to be met in order for a policy to be determined to be “at least as 
comprehensive” as the ISE Privacy Guidelines. 


Due to many centers’ policies being in the review process when the revised Template was 
issued and for a variety of other reasons, centers have submitted modified versions of 
their policies four or more times. In an effort to streamline this review process, a new 
practice has been implemented that will limit centers’ policy submissions to a maximum 
of three or fewer. 


Under the new process, after the second submission and review cycle, if the policy still 
requires revision, the PPRT will not only return the review checklist but will also include 
a red-lined version of the policy suggesting language changes and _ highlighting 
outstanding issues. At that time, either a conference call or Webinar will be initiated with 
the center to address any unresolved items or issues. Participants in this process will be 
PPRT members, the fusion center director, the center’s privacy officer, and the center’s 
legal advisor, as appropriate. The purpose of this interaction will be to reach agreement 
on language additions/changes that will be incorporated into a final draft that the PPRT 
will then submit to the DHS Privacy Office for the requisite ISE Privacy Guidelines 
determination. 


The revised process was recently tested, and it proved successful in reducing both the 
time and level of effort necessary to bring the development of the fusion center’s privacy 
policy to conclusion. 


